AWS DNS, Route 53, CloudFront, and Caching – SAP-C02 Study Guide

Purpose of This Lesson

DNS and caching questions in the AWS Certified Solutions Architect – Professional exam often test service selection and subtle configuration differences. The key areas are Route 53 hosted zones and routing policies, DNS health checks, alias versus CNAME records, CloudFront cache behavior, private DNS, and edge customization.

Key Concepts

Amazon Route 53

Amazon Route 53 combines three related capabilities:

• Domain registration for supported top-level domains.
• DNS resolution through public and private hosted zones.
• Health checking for endpoints, other health checks, and CloudWatch alarms.

Route 53 is a globally distributed AWS service that operates alongside AWS edge locations. When Route 53 hosts a domain’s DNS records, it acts as the authoritative DNS service for that domain.

A hosted zone is a collection of DNS records for a domain:

• Public hosted zone: Resolves names for clients on the internet.
• Private hosted zone: Resolves names within associated VPCs without publishing those records to the internet.

Private hosted zones require both VPC DNS settings to be enabled:

• enableDnsSupport
• enableDnsHostnames

DNS routing determines which address a client receives. It is name resolution, not packet routing through a network path.

Domain and Hosted Zone Account Separation

A domain registration and its hosted zone do not have to reside in the same AWS account. For example, one account can register the domain while another account owns the hosted zone.

Moving a domain between AWS accounts does not automatically move the hosted zone or its records. Hosted zone migration must be handled separately. Domain transfers to or from another registrar also depend on support for the top-level domain and applicable transfer procedures.

Route 53 Health Checks

Route 53 health checks can evaluate:

• An endpoint identified by an IP address or domain name.
• The status of another Route 53 health check.
• The state of a CloudWatch alarm.

Health checks are commonly combined with failover routing so that Route 53 returns a secondary destination when the primary destination is unhealthy. DNS health checks do not replace application-level monitoring or load balancer health checks; they serve different control-plane purposes.

CNAME Versus Alias Records

Both record types can direct a DNS name to another destination, but their capabilities differ.

Feature	CNAME	Alias
Works at the zone apex	No	Yes
Can point to arbitrary DNS names	Yes	No; supports selected AWS targets or a record in the same hosted zone
Route 53 query charge for AWS-resource target	Standard DNS query pricing applies	Queries to supported AWS resources are not charged as Route 53 queries
Typical use	www.example.com to another hostname	example.com to CloudFront, an ELB, or another supported AWS target

The zone apex is the root of the domain, such as example.com. A CNAME cannot be created there because the apex must also support required records such as SOA and NS records. An alias can be used at the apex.

Alias records commonly target supported AWS resources such as:

• Amazon CloudFront distributions
• Elastic Load Balancing load balancers
• Amazon S3 static website endpoints
• Certain other supported AWS endpoints
• Another record in the same hosted zone

Always verify that the intended target type is supported before selecting an alias record.

Route 53 Routing Policies

Route 53 routing policies determine which DNS response is returned. They do not directly load-balance packets after a client has resolved an address.

Policy	Primary decision criterion	Typical use
Simple	One record or set of basic records	Straightforward DNS mapping
Failover	Health of primary and secondary records	Active-passive disaster recovery
Weighted	Relative weights	Gradual migration, canary testing, traffic splitting
Latency-based	Lowest-latency AWS region from the requester	Multi-Region applications optimized for response time
Geolocation	Location of the DNS requester	Regulatory, localization, or content policies
Geoproximity	Geographic distance, optionally adjusted with bias	More control over geographic routing boundaries
Multivalue answer	Multiple healthy values	Basic distribution of several endpoint addresses

Important distinctions:

• Latency-based routing optimizes for measured network latency to configured AWS Regions; it does not simply mean geographic proximity.
• Geolocation routing uses the requester’s location and is useful when policy depends on geography.
• Geoproximity routing allows geographic routing to be adjusted with a bias, shifting traffic toward or away from a location.
• Multivalue answer routing can return multiple healthy records, but it is not a replacement for an Elastic Load Balancer.
• Weighted routing is useful for controlled traffic percentages, but DNS caching means the actual request distribution may not precisely match the configured weights.

CloudFront Caching

Amazon CloudFront caches content at edge locations to reduce latency and origin load. Cache behavior settings can vary by path pattern, allowing different policies for paths such as:

• /images/*
• /static/*
• /api/*

CloudFront caching is influenced by TTL settings and origin response headers:

• Minimum TTL: Lower bound for how long an object remains cached.
• Default TTL: Used when the origin does not provide cache directives.
• Maximum TTL: Upper bound CloudFront uses for caching.
• Cache-Control: max-age: Specifies how long an object can be cached.
• Expires: Supplies an expiration date and time.

After an object expires, CloudFront must contact the origin when the object is requested again. Depending on cache and revalidation behavior, the origin may return a new object or indicate that the cached object remains valid.

Use longer TTLs for immutable, versioned static assets and shorter TTLs for frequently changing content. Separate cache behaviors can apply different policies to different file types or URL paths.

Cache Keys and Request Headers

CloudFront can forward viewer request headers to the origin and can include selected headers in the cache key. This determines whether different header values produce separate cached objects.

The broad choices are:

• Forward all headers: The request is effectively not cacheable because each header variation can create a distinct response context.
• Forward a whitelist: Forward and cache based on only the headers that are required by the application.
• Forward only default headers: Do not vary the cache on arbitrary viewer headers.

Forwarding unnecessary headers reduces cache hit ratio and can significantly increase origin requests. Include a header in the cache key only when the response genuinely varies based on that header.

Signed URLs and Signed Cookies

CloudFront private content can be protected with signed URLs or signed cookies.

A signed URL is appropriate when access is granted to one specific object. A signed cookie is preferable when a user needs access to multiple restricted objects without changing each object’s URL.

A policy can constrain access by:

• Start time
• Expiration time
• Client IP address or IP range, when appropriate
• Specific resource or resource pattern, depending on the mechanism and policy used

These mechanisms provide authorization at the CloudFront distribution layer; they do not make the origin directly unreachable. Restrict the origin separately, such as by using an origin access control for an S3 origin or appropriate network and application controls for a custom origin.

Lambda@Edge

Lambda@Edge runs supported Lambda functions at CloudFront edge locations to customize requests and responses closer to viewers. It supports Node.js and Python runtimes.

The four invocation points are:

1. Viewer request: After CloudFront receives the request and before cache lookup.
2. Origin request: Before CloudFront forwards a cache miss request to the origin.
3. Origin response: After CloudFront receives a response from the origin.
4. Viewer response: Before CloudFront sends the response to the viewer.

The event location affects both behavior and cost. Viewer events run for every request, while origin-request and origin-response events generally run only when CloudFront communicates with the origin. Use the latest AWS documentation for current Lambda@Edge runtime, deployment, and regional restrictions when designing a solution.

Exam-Relevant Takeaways

• Use a private hosted zone for internal DNS names that must not be publicly resolvable.
• Private hosted zones require both enableDnsSupport and enableDnsHostnames on the associated VPC.
• Use an alias when mapping the zone apex to a supported AWS resource.
• Use a CNAME for a non-apex name when the target can be any DNS hostname.
• Combine failover routing with Route 53 health checks for DNS-level active-passive routing.
• Use latency-based routing for lowest-latency Regional endpoints, not geolocation-based business rules.
• Use geolocation routing for policies based on the requester’s country or continent.
• Use weighted routing for controlled traffic splits, migrations, and canary deployments.
• Use signed URLs for individual protected objects and signed cookies for groups of protected objects.
• Configure CloudFront cache behaviors by path so static assets and dynamic content do not share inappropriate TTLs.
• Forward only the headers, cookies, and query strings that affect the origin response; unnecessary variations lower the cache hit ratio.
• Choose the Lambda@Edge trigger based on whether logic must run before cache lookup, around origin communication, or before delivery to the viewer.

Architecture Decision Guide

Requirement	Recommended approach	Reason
Resolve internal service names only inside VPCs	Route 53 private hosted zone	Keeps DNS records private and supports VPC-based resolution
Point example.com to CloudFront	Route 53 alias record	CNAME is not valid at the zone apex
Route users to the lowest-latency Regional endpoint	Latency-based routing	Selects based on latency measurements
Route users according to country-specific rules	Geolocation routing	Uses requester location
Shift 10% of DNS traffic to a new deployment	Weighted routing	Supports relative traffic allocation
Send traffic to a backup site when the primary is unhealthy	Failover routing plus health checks	Provides DNS-level active-passive behavior
Deliver one protected download	CloudFront signed URL	Grants access to one object
Grant access to a set of protected files without changing URLs	CloudFront signed cookies	Applies access across multiple objects
Cache images longer than API responses	Separate CloudFront cache behaviors	Allows path-specific TTL and forwarding settings
Rewrite or inspect requests at the edge	Lambda@Edge	Executes custom logic at a CloudFront event point

Common Exam Traps

• Using a CNAME at the zone apex: A CNAME cannot be created for example.com; use an alias for supported targets.
• Confusing DNS routing with network routing: Route 53 selects DNS responses. It does not forward application packets like a router.
• Treating geolocation as latency optimization: Geolocation enforces geographic policy; latency-based routing optimizes measured latency.
• Assuming weighted routing gives exact percentages: Recursive resolvers and client DNS caching affect the observed distribution.
• Using multivalue answer routing as a full load balancer: It returns multiple healthy DNS values but lacks the connection management and health behavior of ELB.
• Forwarding every header to CloudFront: This can prevent effective caching and increase origin load.
• Choosing signed URLs for many objects: Signed cookies are generally more suitable when the client needs a collection of restricted files.
• Assuming moving a domain moves its hosted zone: Registration and hosted zone ownership are separate concerns.
• Forgetting VPC DNS settings: A private hosted zone will not work as expected if DNS support or DNS hostnames is disabled.
• Assuming CloudFront immediately reflects origin changes: Cached objects remain available until expiration, invalidation, or a versioned object strategy changes what viewers request.

Real-World Engineer Notes

• Prefer versioned filenames for static assets, such as app.2026-09.js, so long TTLs can be used without relying heavily on invalidations.
• Keep dynamic API responses out of the cache unless the cache key and authorization model are carefully designed.
• Avoid including authorization, tracking, or unrelated headers in the cache key unless they change the response.
• DNS failover is not instantaneous because recursive resolvers cache responses according to TTLs. For strict failover requirements, combine DNS with health-aware application or load-balancing controls.
• Protect CloudFront origins directly. A private S3 bucket with CloudFront origin access control is generally safer than a public bucket used only because CloudFront is in front of it.
• Use Route 53 routing policies as part of a broader Multi-Region architecture; DNS selection alone does not replicate data or make an application stateless.
• Treat edge functions as request-path components with operational and deployment constraints. Keep them small, deterministic, and focused on tasks such as redirects, header manipulation, or URL normalization.

Quick Reference Summary

• Public hosted zone: Internet DNS.
• Private hosted zone: DNS for associated VPCs.
• Private VPC prerequisites: enableDnsSupport=true and enableDnsHostnames=true.
• Alias: Works at the zone apex and targets supported AWS resources.
• CNAME: Cannot work at the zone apex; can target arbitrary DNS names.
• Simple: Basic DNS mapping.
• Failover: Primary/secondary based on health.
• Weighted: Relative traffic percentages.
• Latency: Lowest measured latency.
• Geolocation: Requester-location policy.
• Geoproximity: Geographic routing with optional bias.
• Multivalue answer: Multiple healthy DNS values.
• Signed URL: Usually one protected object.
• Signed cookie: Multiple protected objects without URL changes.
• CloudFront: Edge caching and content delivery.
• Lambda@Edge triggers: Viewer request, origin request, origin response, viewer response.

Flashcards

1. Q: What is the difference between a public and private Route 53 hosted zone?

A: A public hosted zone answers DNS queries for internet clients; a private hosted zone answers queries within associated VPCs.

1. Q: Which VPC DNS settings are required for private hosted zones?

A: enableDnsSupport and enableDnsHostnames must both be enabled.

1. Q: Why can an alias record be used at the zone apex while a CNAME cannot?

A: DNS standards require the apex to contain SOA and NS records, which prevents it from being a CNAME. Route 53 aliases provide AWS-specific apex mapping without violating that constraint.

1. Q: When is a CNAME preferable to an alias?

A: When a non-apex DNS name must point to an arbitrary hostname that is not an eligible Route 53 alias target.

1. Q: What does failover routing require for health-based primary/secondary behavior?

A: Primary and secondary records configured with appropriate Route 53 health checks.

1. Q: When should latency-based routing be selected?

A: When users should be directed to the Regional endpoint with the lowest measured network latency.

1. Q: What is the main purpose of geolocation routing?

A: To return different DNS answers based on the geographic location of the requester.

1. Q: What is the difference between signed URLs and signed cookies?

A: A signed URL generally grants access to one object; signed cookies are useful for granting access to multiple objects without changing their URLs.

1. Q: What does CloudFront Cache-Control: max-age control?

A: It specifies how long the object can be cached before CloudFront considers it expired.

1. Q: What happens when unnecessary headers are included in the CloudFront cache key?

A: More cache variants are created, reducing cache hit ratio and increasing origin requests.

1. Q: Which Lambda@Edge trigger runs before CloudFront checks the cache?

A: Viewer request.

1. Q: Which Lambda@Edge trigger runs before a cache-miss request is sent to the origin?

A: Origin request.

Practice Questions

Question 1

A company hosts example.com in Route 53 and wants the apex domain to resolve directly to an Amazon CloudFront distribution. Which record should the solutions architect configure?

A. CNAME record for example.com
B. Alias A or AAAA record for example.com
C. NS record pointing to CloudFront
D. TXT record containing the CloudFront domain name

Correct answer: B

Explanation: A CNAME cannot be used at the zone apex. Route 53 alias records can map the apex to supported AWS resources such as CloudFront. The record type may be A and/or AAAA depending on IPv4 and IPv6 requirements.

Question 2

An organization runs application stacks in two AWS Regions. Users should be directed to the Region that provides the lowest network latency. Which Route 53 policy should be used?

A. Geolocation
B. Weighted
C. Latency-based
D. Geoproximity without bias

Correct answer: C

Explanation: Latency-based routing selects the endpoint associated with the lowest measured latency for the requester. Geolocation is based on geographic location and is intended for location-driven policies rather than latency optimization.

Question 3

A website distributes paid training videos through CloudFront. After authentication, users must access many video files, and the application must keep the existing object URLs unchanged. Which mechanism is most appropriate?

A. A signed URL generated for every video request
B. Signed cookies
C. A public S3 bucket
D. A Route 53 weighted record

Correct answer: B

Explanation: Signed cookies allow access to multiple restricted CloudFront objects without modifying the URLs. Signed URLs are better suited to granting access to individual objects.

Question 4

A private hosted zone is associated with a VPC, but instances cannot resolve its records. Which VPC configuration should be checked first?

A. VPC flow logs
B. NAT gateway route
C. DNS support and DNS hostnames
D. Internet gateway attachment

Correct answer: C

Explanation: Private hosted zones depend on the VPC DNS settings enableDnsSupport and enableDnsHostnames. Internet connectivity and NAT are not required for internal Route 53 private DNS resolution.

Question 5

A CloudFront distribution serves static images and dynamic API responses. The API response varies based on a custom Accept-Language header, but the current behavior forwards all viewer headers. Cache hit ratio is very low. What is the best improvement?

A. Forward no headers and ignore language variations
B. Forward only Accept-Language and include it in the cache key
C. Increase the minimum TTL for all content without changing headers
D. Replace CloudFront with Route 53 multivalue routing

Correct answer: B

Explanation: The response varies on Accept-Language, so that header must be forwarded and included in the cache key. Forwarding all headers creates unnecessary cache variants and can effectively prevent useful caching.